CVE-2025-15518
Published: 23 March 2026
Summary
CVE-2025-15518 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Nx200. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires input validation mechanisms at CLI entry points to block crafted inputs from enabling OS command injection.
Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability through firmware updates.
Ensures receipt and implementation of vendor security advisories directing firmware updates to remediate this specific vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection in administrative network device CLI enables arbitrary command execution via T1059.008.
NVD Description
Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands…
more
on the operating system, impacting the confidentiality, integrity, and availability of the device.
Deeper analysisAI
CVE-2025-15518 involves improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500, and NX600 routers. This flaw allows crafted input to be executed as part of an operating system command, enabling OS command injection as defined by CWE-78. Published on 2026-03-23, the vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker possessing administrative privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation grants the ability to execute arbitrary operating system commands on the device, thereby impacting its confidentiality, integrity, and availability.
TP-Link advisories recommend mitigation through firmware updates available on their support download pages for the Archer NX200, NX210, NX500, and NX600 models. Further guidance is provided in the support FAQ at https://www.tp-link.com/us/support/faq/5027/.
Details
- CWE(s)